A patch cannot be applied immediately to a critical production system. What should the manager require?

1. A risk-based interim treatment, authorized exception, and tracked remediation date
2. A claim that uptime eliminates security risk
3. An undocumented indefinite delay
4. Deletion of the vulnerability scan